New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 697238 link

Starred by 6 users

Issue metadata

Status: WontFix
Owner:
OOO until 4th Feb
Closed: Dec 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Windows , Chrome , Mac
Pri: 3
Type: Bug-Regression
Team-Security-UX

Blocking:
issue 657267
issue 697243


Show other hotlists

Hotlists containing this issue:
EnamelAndFriendsFixIt


Sign in to add a comment

Display Flash default as "Detect" instead of "Ask" again

Project Member Reported by lgar...@chromium.org, Feb 28 2017

Issue description

Some layers seem to be lying: https://cs.chromium.org/chromium/src/chrome/browser/plugins/flash_permission_context.cc?q=CONTENT_SETTING_DETECT_IMPORTANT_CONTENT&l=49&dr=C

This results in Page Info showing Flash setting of CONTENT_SETTING_DEFAULT as if it were CONTENT_SETTING_ASK, even though ContentSettings::GetDefaultContentSetting() returns CONTENT_SETTING_DETECT_IMPORTANT_CONTENT as the default for Flash.

raymes@, could you triage?
 
Summary: Page Info shows Flash as "Ask (default)", but actual default is Detect (was: Page Info shows Flash as "Ask (default)", but default is Detect)

Comment 2 by raymes@chromium.org, Feb 28 2017

Cc: raymes@chromium.org
Owner: tommycli@chromium.org
I think this is intended by tommycli@ can confirm.
Blocking: 697243
I remember a decision for Material Page Info that we wanted to show "Detect (Default)".

If we show "Ask (Default)" instead of "Detect (Default)", then our most promising compromise in Issue (hide permissions set to the default value if that default value of "Ask") will have confusingly misrepresentative UI for the 2nd-most-commonly changed permission.
Labels: -Type-Bug Type-Bug-Regression
> will have confusingly misrepresentative UI for the 2nd-most-commonly changed permission.


Specifically, if we say "Page Info now hides all permissions that have a default value of "Ask", since a site cannot use such a permission until it shows you a prompt for it" then people will wonder why we're not hiding the Flash permission by default.

I don't think a good solution to that is "oh, and Flash is an exception". Because it's actually *not*, and I think we should surface that again.
(Which reminds me, that makes this a regression, assuming we change it back.)
Cc: emilyschechter@chromium.org
Whatever we change the string to, I do think it's important to have flash included by default in Page Info. The reason being that a prompt won't reliably be shown. If a site wants to use geolocation, a prompt will always be shown, but with HTML5 by default, that won't be the case.

I think we might have changed this to "Ask" when we enabled HTML5 by default, so I don't think this is a regression. 

I understand your reasoning that the language might be inconsistent if the only thing that is Ask that we show is flash. But it's also hard to come up with a better string here. I'm not sure that Detect is accurate anymore.
Cc: benwells@chromium.org
Hey, I just saw the patch go by that enables HBD by default for 100% of Stable users...

So it should definitely be "Ask".
Cc: tommycli@chromium.org
Owner: lgar...@chromium.org
Summary: Decide how to display the Flash permission in Page Info (was: Page Info shows Flash as "Ask (default)", but actual default is Detect)
Thanks Tommy!
I love opening bugs that are already resolved :)
I think there's still a question as to what to how we display flash in PageInfo. It does say "Ask" by default but it behaves differently to other ASK permissions in the sense that a permission bubble won't reliably be shown.
I agree with #6 that we should show Flash by default in PageInfo and that it would be inconsistent and confusing if it remained "ask".

Why is "detect" inaccurate or bad? (Maybe I'm missing something)
The most accurate string, in probably both places, is "Prefer HTML".

There's not much detection going on in the post-HBD world -- and we only ask if the user clicks on a Download Flash link or a placeholder.
One thing we could do is rename it back to "Detect" for as long as the site engagement threshhold is around. That would be pretty accurate for that case. Then when the site engagement threshhold is removed, we change it back to "Ask" but also remove it from Page Info. I think by that stage flash usage will be down and it will be less important to include it there. 

tommycli/lgarron: what do you think about that plan?
^ I think Raymes' reasoning is solid.
Cc: dominickn@google.com
SGTM2. +Dom FYI.
Cc: -dominickn@google.com dominickn@chromium.org
Detect still makes the most sense to me too. SGTM3. :)
Blocking: 657267
Status: Started (was: Assigned)
Alright, I'm going to send a CL to change back to "Detect".
Summary: Display Flash default as "Detect" instead of "Ask" again (was: Decide how to display the Flash permission in Page Info)
I doubt a screenshot is necessary, but here we go.

https://codereview.chromium.org/2731083002
Screen Shot 2017-03-03 at 15.50.39.png
157 KB View Download
Labels: OS-Chrome OS-Linux OS-Mac OS-Windows

Comment 22 by kgra...@gmail.com, Mar 15 2017

I'm seeing inconsistent behavior with this as well. On Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.98 Safari/537.36.

If I visit http://webhtb.sourceforge.net/video_demo.html I'm not able to context click and "Run this plugin" (option is greyed out). However, upon click, I get a new kind of permission dialog (like the "Allow access to mic" dialog), and it then runs the SWF. However, nothing shows up in chrome://settings/contentExceptions#plugins !

Now the plugin always runs. Changin the url info menu settings as in #20 does allow me to block it again, but never get back the "run only this time" (e.g. ask) option.
This is no longer as important now that hiding default permissions is on hold.

How soon will "Ask" be the correct value?
Probably Oct 2017: https://sites.google.com/a/chromium.org/dev/flash-roadmap#TOC-HTML5-By-Default-Target:-Chrome-55---Dec-2016-

I'd prefer to keep the status quo so long as we're showing Detect in the UI surfaces.

If we're changing all the UI surfaces to ASK, we should migrate all the actual content settings in one fell swoop.
Labels: Hotlist-EnamelAndFriendsFixIt
Cc: -raymes@chromium.org
Owner: raymes@chromium.org
raymes do you know what the current status of this is?
Status: WontFix (was: Started)
The site engagement threshhold is now 100% and we're using "Ask" language. I think things are consistent. Marking WontFix.

Sign in to add a comment